diff --git a/docs/organizations/managing-security-and-risk.md b/docs/organizations/managing-security-and-risk.md
index 6cf8eb9e39..01d6494379 100644
--- a/docs/organizations/managing-security-and-risk.md
+++ b/docs/organizations/managing-security-and-risk.md
@@ -26,7 +26,7 @@ Each panel shows the total count of matching items and contains a **Review** but
When viewing the dashboard, you can:
- Limit the total counts in each panel to a specific set of severities or repositories by clicking the **Severity** or **Repository** drop-downs above the main area.
-- Export a list of items as a CSV file by clicking the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters.
+
- Review the [severity assignment rules](#item-severities-and-deadlines) by clicking the **See rules** button in the top right-hand corner of the page.
![Security and risk management dashboard](images/security-risk-management-dashboard.png)
@@ -40,12 +40,19 @@ To access the item list, access the [dashboard](#dashboard) and click the **Revi
When viewing the item list, you can:
- Update the filtering criteria by clicking the **Severity**, **Status**, or **Repository** drop-downs above the list.
+
- Find out more about an item by clicking its **Details** column to navigate to the item of interest on the source platform.
-- Export a list of items as a CSV file by clicking the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters.
+
- Review the [severity assignment rules](#item-severities-and-deadlines) by clicking the **See rules** button in the top right-hand corner of the page.
![Security and risk management items](images/security-risk-management-item-list.png)
+## Exporting the security item list
+
+!!! info "This feature is available only to organization admins and organization managers"
+
+To export a list of security items as a CSV file, click the **Export CSV** button in the top right-hand corner of the page. The exported list always includes all items, ignoring any applied filters.
+
## How Codacy manages security items {: id="opening-and-closing-items"}
!!! important
diff --git a/docs/organizations/roles-and-permissions-for-organizations.md b/docs/organizations/roles-and-permissions-for-organizations.md
index c435e82b60..4f4f238f74 100644
--- a/docs/organizations/roles-and-permissions-for-organizations.md
+++ b/docs/organizations/roles-and-permissions-for-organizations.md
@@ -64,6 +64,15 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp
Yes |
Yes |
+
+ Access Security and risk management |
+ No |
+ Yes3 |
+ Yes3 |
+ Yes3 |
+ Yes |
+ Yes |
+
Ignore issues and files, configure code patterns and file extensions, manage branches, reanalyze branches and pull requests |
No |
@@ -96,7 +105,7 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp
No |
No |
No |
- Yes3 |
+ Yes4 |
Inherits original permission |
Yes |
@@ -118,15 +127,6 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp
Yes |
Yes |
-
- Access Security and risk management |
- No |
- No |
- No |
- No |
- Yes |
- Yes |
-
Invite and accept members, modify billing |
No |
@@ -150,7 +150,8 @@ The table below maps the GitHub Cloud and GitHub Enterprise roles to the corresp
1: Outside collaborators aren't supported as members of organizations on Codacy. You can still [add outside collaborators to Codacy](managing-people.md#adding-people) so that Codacy analyzes their commits to private repositories, but they won't be able to join your Codacy organization.
2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization).
-3: Requires that an organization owner has given the Codacy GitHub App access to the repositories to add or remove.
+3: These users can only see security items originating from Codacy repositories that they follow.
+4: Requires that an organization owner has given the Codacy GitHub App access to the repositories to add or remove.
## Permissions for GitLab
@@ -199,6 +200,15 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp
Yes |
Yes |
+
+ Access Security and risk management |
+ No |
+ Yes3 |
+ Yes3 |
+ Yes3 |
+ Yes |
+ Yes |
+
Ignore issues and files, configure code patterns and file extensions, manage branches, reanalyze branches and pull requests |
No |
@@ -253,15 +263,6 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp
Yes |
Yes |
-
- Access Security and risk management |
- No |
- No |
- No |
- No |
- Yes |
- Yes |
-
Invite and accept members, modify billing |
No |
@@ -284,7 +285,8 @@ The table below maps the GitLab Cloud and GitLab Enterprise roles to the corresp
1: External users aren't supported as members of organizations on Codacy. You can still [add external users to Codacy](managing-people.md#adding-people) so that Codacy analyzes their commits to private repositories, but they won't be able to join your Codacy organization.
-2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization).
+2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization).
+3: These users can only see security items originating from Codacy repositories that they follow.
## Permissions for Bitbucket
@@ -319,6 +321,12 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre
Yes |
Yes |
+
+ Access Security and risk management |
+ Yes3 |
+ Yes |
+ Yes |
+
Ignore issues and files, configure code patterns and file extensions, manage branches, reanalyze branches and pull requests |
Configurable |
@@ -355,12 +363,6 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre
Yes |
Yes |
-
- Access Security and risk management |
- No |
- Yes |
- Yes |
-
Invite and accept members, modify billing |
No |
@@ -377,7 +379,8 @@ The table below maps the Bitbucket Cloud and Bitbucket Server roles to the corre
1: Codacy can't distinguish the Bitbucket roles Read and Write because of a limitation on the Bitbucket API.
-2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization).
+2: Joining an organization may need an approval depending on your setting for [accepting new people](changing-your-plan-and-billing.md#allowing-new-people-to-join-your-organization).
+3: These users can only see security items originating from Codacy repositories that they follow.
## The organization manager role